nspawn: Add support for delegated UID ranges

We expose this via --private-users-delegate= which takes the number of
ranges to delegate. On top of delegating the ranges, we also mount in
the nsresourced socket and the mountfsd socket so that nested containers
can use nsresourced to allocate from the delegated ranges and mountfsd to
mount images.

Finally, we also create /run/systemd/dissect-root with systemd-tmpfiles to
make sure it is always available as unpriv users won't be able to create it
themselves.

tmpfiles.d/systemd-nspawn.conf

@@ -21,3 +21,8 @@ Q /var/lib/machines 0700 - - -
 
 R! /var/lib/machines/.#*
 R! /.#machine.*
+
+# If the nsresourced/mountfsd sockets are mounted into /run/host, symlink them to their canonical
+# location in /run/systemd.
+L? /run/systemd/io.systemd.NamespaceResource - - - - /run/host/io.systemd.NamespaceResource
+L? /run/systemd/io.systemd.MountFileSystem   - - - - /run/host/io.systemd.MountFileSystem

tmpfiles.d/systemd.conf.in

@@ -18,6 +18,7 @@ d$ /run/systemd/sessions 0755 root root -
 d$ /run/systemd/users 0755 root root -
 d /run/systemd/machines 0755 root root -
 d$ /run/systemd/shutdown 0755 root root -
+d /run/systemd/dissect-root 0000 root root -
 
 d /run/log 0755 root root -